Oracle Reports Server Arbitrary File Disclosure Vulnerability

Bugtraq ID:	14312
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 19 2005 12:00AM
Updated:	Jul 19 2005 12:00AM
Credit:	Discovery is credited to Alexander Kornbrust.
Vulnerable:	Oracle Oracle Reports6i 6.0.8 .19 Oracle Oracle Reports6i 6.0.8 Oracle Oracle Reports 9i Oracle Oracle Reports 6 Oracle Oracle Reports 10g 9.0.4 .3.3 Oracle Oracle Reports 10g 9.0.4 Oracle Oracle Reports 10g 9.0.3 Oracle Oracle Reports 10g 9.0.2 Oracle Oracle Reports 10g 9.0.1 Oracle Oracle Reports 10g 9.0
Not Vulnerable:

Oracle Reports Server Arbitrary File Disclosure Vulnerability

Oracle Reports Server may allow remote attackers to disclose parts of arbitrary files.

Reportedly, the server fails to restrict users from accessing parts of arbitrary files when handling specially crafted HTTP GET requests.

All versions of Oracle Reports Server are reported to be vulnerable to this issue.

Oracle Reports Server Arbitrary File Disclosure Vulnerability

An exploit is not required.

The following proof of concept is available:

http://www.example.com:7778/reports/rwservlet?server=myserver+report=test.rdf+userid=sc
ott/tiger@iasdb+destype=file+MODE=CHARACTER+desformat=/etc/passwd

Oracle Reports Server Arbitrary File Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Oracle Reports Server Arbitrary File Disclosure Vulnerability

References:

• Oracle Reports 10g Home Page (Oracle)
  
• Oracle Support Metalink (Oracle)
  
• Oracle Security Advisory: Read parts of any file via desformat in Oracle Reports ([email protected])